What Your Business Can Learn from Apple's Lost iPhone

Did you hear the one about the guy who walks into a bar and ends up losing the next generation of Apple's iPhone? According to Gizmodo.com, the guy is Gray Powell, an Apple software engineer who was field-testing the device. Long story short, Powell left the phone--which isn't scheduled to be released until at least summer 2010--in a bar in Redwood City, Calif., where someone picked it up, looked for its owner but couldn't find him, realized it wasn't just any ordinary iPhone, called Apple to see if they wanted it back (he couldn't find anyone who took him seriously) and eventually sold it to the website for $5,000.

While the situation of the missing iPhone--and everything that's happened since--will make for fascinating case studies for law schools, public relations agencies and MBA students, there are a number of takeaway's entrepreneurs and business owners can learn from today. I sat down with Ieuan Mahony, a Boston-based attorney with Holland & Knight specializing in technology-related intellectual property, to discuss the ramifications of Apple's blunder and how your business can respond if something similar happens to you.

Mikal E. Belicove: If this happened to your company, what would you do?

Ieuan Mahony:First, I'd triage and then I'd look carefully at my security practices (even if I had security as fabled as Apple's) to prevent an incident like this happening again. So, work fast to fix this "snapshot" emergency, then turn to "fixing the bugs" that caused the problem, going forward.

MB: When you say "triage" what do you mean? Are you saying legal action?

IM: Yes, let's focus only on the legal perspective. If this were my company, I'd want to think carefully on three legally-driven points:

What is the core damage, if any, that I'm suffering (as opposed to more transient public relations, "yesterday's news" damage).

What legal options are available to me to mitigate this damage.

What is the likelihood that some or all of these legal steps might work, or a bigger concern--actually make the situation worse.

MB: Do you think Apple is suffering core damage from the outing of this "supersecret version of the iPhone"--to use the New York Time's descriptive phrase?

IM:Not yet. Let's look at Apple's response to Gizmodo's publicity over the loss of the device. Gizmodo has posted a letter from Apple's senior vice president and general counsel, Bruce Sewell. In this letter, Apple simply requests that Gizmodo return the device, and does not shout: "Evil wrongdoer! Injustice! Infringement!" or other threats. Apple's response is low key. Behind the curtain of this low key response, I believe, lies a good, careful assessment by the Apple team of Apple's legal rights in this specific situation, Apple's exposure to further damage from the Gizmodo disclosures and, more importantly, the potential longer-term legal impact of this incident.

I do not think the low key response reflects any indecision by the Apple team.

MB: What are Apple's legal options?

IM: Apple's options primarily rely on two separate bodies of law: (1) laws that govern tangible property, like the physical iPhone device itself; and (2), laws that govern intangible property--like the intellectual property assets that are likely embodied in this prototype iPhone (like the OS 4 platform that the device may have run before Apple remotely disabled--or bricked--the device.

Laws that govern the right to possess physical property define whether Gizmodo has the right to say to Apple, "We bought this device from someone who found it in a public place, finders keepers. We own this device and will not return it to you." In contrast, laws that govern intellectual property attach to things beyond the device itself--the meta aspects of the device. These laws govern Gizmodo's right to access and exploit the cool stuff that this device instantiates. For example, Gizmodo's right to say, "Discerning members of the public, come to our website. There we will reveal to you for your use and enjoyment the specific functionality and sensitive performance details of the device that Apple has hitherto kept locked behind unscalable walls and a moat."

Broadly speaking, Apple has the options of (a) treating the matter as if it involved simply the loss of a physical item, like the keys to your car, (b) treating the matter as if it involved the misappropriation and disclosure of highly sensitive and valuable trade secrets (as well as potential misuse of other intellectual property), or (c) both of these approaches.

To date, Apple has adopted only the first approach.

MB: If this were your company, which option would you advocate?

IM: I would want my company to really be careful to avoid making matters worse. A good rule of thumb is: "The more you say 'Ouch' the more your opponent will say 'Does it hurt there? Let me poke again to see.'" So if I were in Apple's position, I would like a low key response.

And [it's good] didn't Apple shout "infringement"? In my view, this would threaten to pull pebbles from under that huge boulder on the cliff above [their] town.Apple did a pretty good job of [damage control], reports indicate that within hours of the loss, Apple bricked the device, likely avoiding--or at least mitigating--core damage.

If Apple were to launch an intellectual property offensive against Gizmodo, or any other actors in this incident, near all spotlights from the legal perspective to the PR perspective, would focus on Apple's security failings. And that would not be good.

MB: If Apple did bring a case against Gizmodo, what would it have to do to win?

IM: To claim intellectual property infringement, Apple would likely rely most heavily on so-called trade secret law. Under trade secret law, and states generally have [different] formulations of this rule, Apple would win the case if it were to establish each of the following elements in the case:

That Gizmodo learned these secrets through its possession of the prototype iPhone.

That Gizmodo had notice that Apple asserted the right to protect this information as a trade secret.

That Gizmodo had notice that its access to this device was due to a mistake, such as an Apple employee's misplacing the device.

And if Apple were successful, it could obtain money damages from Gizmodo and other sanctions.

A brief reading of these elements shows that Apple's case looks pretty good, but for element two; did Apple take appropriate steps to protect the claimed trade secret information. If we are to believe the reporting on these points; Apple didn't prevent one of its engineers from removing this "supersecret" device from its research facilities, this engineer left the device on his bar stool after celebrating his 27th birthday, although the device was disguised a bit to look like a commonplace iPhone the "secret sauce" in the device was not secured by even kindergarten password protection and when the finder of the device called Apple to try to report that he'd found the device, Apple did not respond.

MB: Thank you, Ieuan.

It seems that if companies have preventative measures in place, and take swift action to stop leaks, then they just might have a case for property infringement. But you have to ask yourself; "Do I really want to open our security measures to the type of public scrutiny that will follow?"